A customer who just wants a Fabric capacity still gets a full Azure subscription, with everything that implies. Skipping the platform landing zone is usually the right call. Skipping the guardrails that make that safe is a different decision, and it is the one people make by accident.
Deployment stacks give you Complete mode without the blast radius, and deny settings are the reason to adopt them. Then I moved a protected resource to another resource group and watched the protection stay behind.